Title-Insurance Company Exposes 885 Million Records Online

Title-insurance provider First American may have exposed 885 million property records online, including names and Social Security numbers.

Shares

A leading American title-insurance provider's website apparently failed to protect 885 million property-transaction records stored in an online database, exposing names, mailing addresses, home addresses, Social Security numbers, drivers' license images, bank account numbers and mortgage and tax records of presumably tens or hundreds of millions of real-estate buyers and sellers.

(Image credit: thodonal88/Shutterstock)

The records were reportedly accessible on the website of Santa Ana, California-based First American Financial Corporation, one of the top providers of title insurance and property-sale closing and settlement services in the United States.

Unfortunately, as with the Equifax data breach of 2017, there's not much that you can about this if you think you may have been affected, other than considering signing up with an identity-protection service. Access to the data was shut down earlier today (May 24).

This all came to light when a real-estate developer in Washington state noticed that if he changed the reference number in a weblink that First American had given him concerning one of his own properties, he could view records pertaining to other First American clients through his web browser.

The developer contacted independent information-security reporter Brian Krebs, who in turn got First American to admit that there had been "a design defect in an application that made possible unauthorized access to customer data."

"We are currently evaluating what effect, if any, this had on the security of customer information," the company told Krebs. "We will have no further comment until our internal review is completed."

There is no evidence suggesting that any malicious person accessed, or did not access, the data, which would be a treasure trove for online criminals and fraudsters. However, Krebs was able to access documents going back 16 years, and it's hard to imagine that only one person would have noticed if the data had indeed been easily accessible all that time.

In the U.S., land and property registration does not guarantee infallible ownership of a piece of real estate, and so title-insurance companies provide indemnity in case ownership of a piece of property is challenged. If you've ever bought or sold real estate in the U.S., you've encountered a title-insurance company.